A firewall rule failed to apply. RuleName and Error are key.
Minimal attack relevance. May indicate rule conflicts from malicious rule injection.
Alert: failures for security-critical inbound block rules.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4957 // Windows Firewall did not apply the following rule
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4957
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# Windows Firewall did not apply the following rule — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`Windows Firewall did not apply the following rule. A firewall rule failed to apply. RuleName and Error are key.
Event 4957 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Alert: failures for security-critical inbound block rules.